Two denial of service problems have been found in the OpenSSH server. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2006-4924 The sshd support for ssh protocol version 1 does not properly handle duplicate incoming blocks. This could allow a remote attacker to cause sshd to consume significant CPU resources leading to a denial of service. CVE-2006-5051 A signal handler race condition could potentially allow a remote attacker to crash sshd and could theoretically lead to the ability to execute arbitrary code. For the stable distribution (sarge), these problems have been fixed in version 1:3.8.1p1-8.sarge.6. For the unstable and testing distributions, these problems have been fixed in version 1:4.3p2-4. We recommend that you upgrade your openssh package.
Two denial of service problems have been found in the OpenSSH server. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities:
The sshd support for ssh protocol version 1 does not properly handle duplicate incoming blocks. This could allow a remote attacker to cause sshd to consume significant CPU resources leading to a denial of service.
A signal handler race condition could potentially allow a remote attacker to crash sshd and could theoretically lead to the ability to execute arbitrary code.
For the stable distribution (sarge), these problems have been fixed in version 1:3.8.1p1-8.sarge.6.
For the unstable and testing distributions, these problems have been fixed in version 1:4.3p2-4.
We recommend that you upgrade your openssh package.
MD5 checksums of the listed files are available in the original advisory.
Vulmon